Keystone to Destroy 18,835 Hardware Wallets After Authentication Key Compromise

Hardware wallet manufacturer Keystone has announced it will destroy 18,835 devices from its warehouse inventory. The decision follows an incident where an attacker gained access to customer data and obtained the key used by the company to verify the authenticity of its devices.

This key is written into the wallets during the manufacturing process and cannot be erased or overwritten. The company assured users that the key is not used to generate seed phrases, create private keys, or sign transactions.

However, with possession of the key, the attacker could create counterfeit devices that would successfully pass the authenticity check on the Keystone website. If these fake devices reach customers who accept them as genuine Keystone products, those customers could lose their crypto assets.

Keystone is permanently discontinuing the use of the old key. All new devices will be released with a new authentication key. The 18,835 hardware wallets currently in stock, which contain the compromised key, will be destroyed and will not be sold, the company pledged. Keystone has suspended shipments of all unpaid devices ordered through the official website and switched sales to a pre-order mode until production of devices with the new key is established.

On October 20, Keystone’s monitoring systems detected suspicious activity on the website. An unknown party exploited a vulnerability in the data monitoring tool. As a result, the personal data of 25,964 customers who placed orders on the Shopify platform between 2024 and 2026 was compromised. Names, contact details, delivery addresses, and order information were made publicly available. Fortunately, the attacker did not gain access to users’ seed phrases, private keys, or payment data.

According to Keystone’s internal policy, customer data should be deleted after 180 days, the company’s representatives explained. An automated tool for mass deletion malfunctioned. They admitted that the compromised data was not deleted on time. The hacker gained access to 12,873 records of incomplete orders, which also contained names, contact details, and delivery addresses.

Devices delivered before October 20 are considered usable by the manufacturer, provided they pass the authenticity check. Customers who received a wallet with the old key after October 20 are advised to contact customer support for additional verification. Even if a device passes authentication, the possibility that it is a counterfeit cannot be entirely ruled out.

The company announced that it will not ask wallet owners to return their devices. Anyone claiming they need to send the wallet for replacement is declared a scammer.

Previously, another major hardware crypto wallet manufacturer, Ledger, admitted that a group of hackers had specifically purchased devices. The attackers opened the wallets and installed hidden modules to intercept seed phrases. Wallets with spyware modules even appeared on the Russian marketplace Ozon.